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FIG. 8 



Client-PG conversation 
35.307723 client.2894 > PG.80: S 649812829:649812829(0) win 8192 id 37968 
<mss 536> 

35.307807 PG.80 > client.2894: S 2103996938:2103996938(0) ack 649812830 

win 32736 id 22893 <mss 536> 
35.394877 client.2894 > PG.80: . ack 1 win 8576 id 37989 
35.402592 client.2894 > PG.80: P 1 :405(404) ack 1 win 8576 id 37991 
35.404046 PG.80 > client.2894: P 1 :1 60(1 59) ack 405 win 32736 id 22902 
35.404327 PG.80 > client.2894: F 160:160(0) ack 405 win 32736 id 22903 
35.499080 client.2894 > PG.80: . ack 161 win 8417 id 38023 
35.598546 client.2894 > PG.80: F 405:405(0) ack 161 win 8576 id 38049 
35.598617 PG.80 > client.2894: . ack 406 win 32735 id 22925 
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35.307723 client.2894 > PG.80: S 649812829:649812829(0) win 8192 id 37968 
<mss 536 > 

EWS duplicates client open 

35.307864 client.2894 > IG.80: S 649812829:649812829(0) win 8192 id 37968 
<mss 536 > (ews) 

35.307807 PG.80 > client.2894: S 2103996938:2103996938(0) ack 64981 2830 
win 32736 id 22893 <mss 536> 

Invisible Ghost responds to open 

35.308005 IG.80 > client.2894: S 1396028487:1396028487(0) ack 64981 2830 
win 32736 id 44202 <mss 536> 



FIG. 10{ 



35.394877 client.2894 > PG.80: . ack 1 win 8576 id 37989 

EWS duplicates client first ack, adjusting sequence numbers 
35.394940 client.2894 > IG.80: . ack 1 win 8576 id 3750 (ews) 

35.402592 client.2894 > PG.80: P 1:405(404) ack 1 win 8576 id 37991 

EWS duplicates client request 

35.402723 client.2894 > IG.80: P 1:405(404) ack 1 win 8576 id 37991 (ews) 



FIG. Ill 



Invisible Ghost responds with 196 bytes 

35.404068 IG.80 > client.2894: P 1 :1 97(1 96) ack 405 win 32736 id 44209 
Production Ghost with 159 bytes 

35.404046 PG.80 > client.2894: P 1:160(159) ack 405 win 32736 id 22902 
PG closes connection 

35.404327 PG.80 > client.2894: F 160:160(0) ack 405 win 32736 id 22903 
IG closes connection 

35.404457 IG.80 > client.2894: F 197:197(0) ack 405 win 32736 id 44210 



FIG. 12 1 



Client acknowledges data & FIN 

35.499080 client.2894 > PG.80: . ack 161 win 8417 id 38023 

EWS ack's data (rounding to packet boundary) 

35.499146 client.2894 > IG.80: . ack 197 win 8381 id 3776 (ews) 

EWS ack's FIN (blowing window open for drain) 

35.540786 client.2894 > IG.80: . ack 198 win 65533 id 3778 (ews) 



FIG. 131 



35.598546 client.2894 > PG.80: F 405:405(0) ack 161 win 8576 id 38049 
35.598604 client.2894 > IG:80: F 405:405(0) ack 198 win 8576 id 38049 (ews) 
35.598617 PG.80 > client.2894: . ack 406 win 32735 id 22925 
35.598754 IG.80 > client.2894: . ack 406 win 32735 if 4421 6 
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